r/UoPeople

Canvas is the platform my school uses for... everything. As the note says, it's been breached by a hacking group, so all of my data is there now, too. I cannot study for any of my exams, complete any assignments, or do anything else until this is fixed. I'm gonna be SO MAD if I lost all my writing 😞 I was so proud of what I wrote

Edit: This was an in-class exam (timed essay prompt) in a locked browser. Copy-pasting was disabled, so there was no way to work offline. Stop blaming me for "not backing up" or saying that "writing directly into the browser" was stupid. It was the only option.

This is from my most recent response from advising! Has anyone else been told this?

Hey all,

This is the response I just received to my emails regarding Rosalyn. This is the first response I’ve seen where they have acknowledged that they are discussing further internally. Doesn’t mean they will change anything, but at least means they have heard us all enough to discuss. My original email is attached as well for reference. I’ll be responding with follow up questions after work. Leave your comments if there are any of your own complaints you want me to reiterate to them in my next response.

I think the flair is appropriate lmao

I do not consent to having my likeness recorded by an AI I am not in control of.

I do not consent to an AI I am not in control of to record and process my data.

I am not buying a laptop or any hardware that will enable this because I do not have the funds available.

Seriously, who even asked for this ? This is NOT REQUIRED.

Their reasoning is to maintain and uphold academic integrity of their programs but the system we had was seriously enough- and it is the students' own responsibility to maintain academic integrity of their own work , if you cheat you are only cheating yourself.

Face it lmao those who cheat ( shame on you ) will find a way regardless so what is even the point of this AI besides being totally invasive to privacy??

Can those of us who are against it create a petition to lobby against this?

Edit : Petition created here's the link :

https://c.org/hkm6q4SJkj

Hey guys i know it's long but it's extremely detailed and helps you also understand the implications of becoming a lab rat at UoPeople for third party AI training data.

All students (especially CS students) should read this and dive deeper.

Summary (see full email below): the addition of Rosalyn AI is putting our biometric data into the hands of an AI company that wants it to train their AI, and their facial recognition software, basically making us lab rats because we want a solid distance learning education system. It sort-of goes against the agreement we had with UoPeople, and it certainly is an unethical transition to students who are already enrolled. The uni will never be responsible if our data is leaked - not their problem - which to me makes it an even worse deal.

Hope you read through it for your own education.

Email sent:

Dear President Reshef and the Executive Team,

I am writing to you on behalf of a rapidly growing group of students who are deeply concerned about the university's partnership with Rosalyn AI. In just three days, over 340 people have signed a petition opposing the mandatory use of this software, and the numbers are growing rapidly(https://www.change.org/p/no-forced-ai-proctoring-at-uopeople).

While it is true that some students are avoiding Rosalyn due to hardware constraints, financial difficulties, or simply a desire to bypass proper proctoring and cheat, those are not the primary issues I foresee. To clarify my stance, I am not here to lecture against guardrails, I'm here to stand my ground on my digital activity being private, secure, and in my absolute control.

My core of this opposition is from a position of genuine understanding and fear of severe security vulnerabilities and the privacy implications of how our personal data is handled.

Firstly, the Danger of Administrator-Level AI Access

Granting a third-party AI system administrator-level access to my personal computer is an unacceptable security risk, I do not even make with other aspects of my digital life. We now know that even the most advanced AI systems on the market are prone to severe errors.

If we look at top-of-the-line systems, which operate at a much higher level than Rosalyn AI, the flaws are well-documented:

Google Antigravity IDE: in a recent documented incident, an AI misunderstood a basic prompt to clear cache, bypassed safety safeguards, and executed a system-level deletion that wiped an entire hard drive, permanently destroying files (Technical Disclosure Commons, 2026).

Claude Code: Large-scale studies show that global-leaders of AI agents frequently create security vulnerabilities directly into live code (arXiv, 2026).

If multi-billion-dollar models make highly destructive mistakes when given such system-level permissions, it is highly irresponsible to force students to grant operating system access to a new player in this market “Rosalyn AI”. The potential for the software to make an unprompted error or corrupt hard drives is a technical reality we should not accept.

Data Harvesting and Privacy Violations

Beyond the security threat to our hardware, there is the issue that scares me more: what these AI companies do with our personal data.

We do not want to provide third-party platforms with our biometrics, continuous computer activity, and administrator access just so they can train their AI models.

Rosalyn AI openly admits to using student data for this exact purpose. Straight from their own website (Rosalyn.ai, 2024):

“Rosalyn also put in place concrete policies and business processes to minimize the collection and retention of data while obtaining consent from students for the use of data to improve and iterate on our AI models."

They also state:

"In keeping with our commitment to privacy, we’ve rolled out our AI ID Verification feature that ensures candidate authenticity without relying on biometrics... It assesses the readability of the ID, verifies the presence of a face, and cross-references the provided data... all while respecting the individual’s privacy."

Despite their claims of "respecting privacy," the reality is that the university is forcing students to consent to having their faces, IDs, and system activity fed into machine learning models which none of us consented to.

Often, non-consent is called something other than ‘progressive and quality education’ which I thought I signed up for at UoPeople.

The Hidden "Data Map" and Microsoft Azure

Furthermore, as a person with hands-on experience with Azure BaaS, I know that Rosalyn relies on Microsoft Azure and its AI Face services for its backend infrastructure. Companies use Azure to process millions of biometric data points to recognize patterns and "train" AI models like the ones used for proctoring (Microsoft, 2024).

While cloud providers make promises, the reality of how our data is handled is alarming. Under the DPA (Data Protection Addendum), Microsoft's contractual privacy commitments flow down to any subcontractors they hire, but this creates a complex "data map" where your information exists in multiple systems simultaneously. Once our data is ingested, we lose visibility into exactly where our faces and digital activity data are being stored or processed, since it's by various subcontractors (Microsoft, 2024).

The July 2025 Hacks and Data Leaks

Storing sensitive student data on these interconnected cloud networks is simply not safe. We only need to look back at the massive cybersecurity incidents of July 2025, when a wave of data leaks hit major tech systems and cloud platforms worldwide (CM-Alliance, 2025).

Notably, in July 2025, a critical vulnerability was exposed in Microsoft Azure (CVE-2025-55241) that allowed attackers to completely bypass multi-factor authentication and impersonate Global Administrators across networks, leaving stored data entirely exposed to attackers (The Hacker News, 2025).

Future at UoPeople

If massive tech companies suffer breaches that leak millions of records, how can UoPeople guarantee the safety of our biometric data and system access in the hands of Rosalyn AI? The reality is that you cannot, and will not be able to protect our data once it's out of your hands. We are unwilling to accept this risk that you cannot be held responsible for.

As a student that enrolled in 2022 under the terms of

You and I signed that:

The policy in effect during your 2022 enrollment clearly outlined two distinct options for proctoring, establishing a choice that is now being restricted:

- “You may choose either an 'offline' proctor free of charge or an online proctoring service where you may take your exams online at home, using a webcam and a reliable high-speed internet connection” (University of the People, 2016)

Furthermore, the clause on “Opt-In Consent" for Sensitive Data. The University's privacy policy sets a specific threshold for sharing "sensitive" as well as “confidential” information, which is adding to the argument against automated biometric tracking without new consent or alternative options:

- “The University requires opt-in consent (meaning, your express permission) to share any sensitive personally identifiable information, such as medical information or information concerning race or ethnicity, political or religious beliefs, and sexuality" (University of the People, n.d. “University of the People privacy policy.”).

- “Except as provided by law, as set out in the terms of its Privacy Policy, or as provided in other University policies, the University will not publish or reveal the academic records or confidential information of a student, applicant or member of its personnel team to a third party" (University of the People, n.d. “University of the People privacy policy.”).

Although you do touch on the opposing view of your autonomy to change rules in the agreements, within your student catalog, such as the clauses on

- “Students are responsible for informing themselves about the applicable policies, regulations, rules and requirements, and registration as a student constitutes acceptance of the statements and a commitment to abide by them” (University of the People, 2021; “Administrative policies. UoPeople Graduate Catalog 2021-2022.”).

As well as

- “The University may access and observe communications conducted in the Virtual Learning Environment for regulatory, accreditation, research, and other administrative purposes such as enforcing the General Code of Conduct” (University of the People, n.d; “Technology. UoPeople Catalog.”).

I am not claiming you are doing something unlawful - more so - I am claiming that by adding the Rosalyn AI as mandatory, rather than optional, you are creating a strong barrier to entry and an unethical transition into an enforced non-consentual solution. Said solution has improperly handled security in the past, and will in the future, with our data - your students - which you are avoiding any responsibility over by passing it on to a third party.

The students and I are asking UoPeople to stop forcing the use of Rosalyn AI before it is fully enforced. Students should not have to give up total control of our computers and our digital autonomy and privacy just to take an exam. We need an alternative that is both reliable and secure for the school and safe for the students.

Thank you for your time and your immediate attention to this matter.

Sincerely,

- third year happy CS student at UoPeople.

References

CM-Alliance. (2025, August). July 2025 biggest cyber attacks, ransomware attacks and data breaches . https://www.cm-alliance.com/cybersecurity-blog/july-2025-biggest-cyber-attacks-ransomware-attacks-and-data-breaches

Microsoft. (2024). Data, privacy, and security for Face . Microsoft Learn. https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/face/data-privacy-security

Microsoft. (2024). Microsoft privacy principles

https://www.microsoft.com/en-us/trust-center/privacy/privacy-principles

Rosalyn.ai. (2024). Unveiling Rosalyn AI’s advanced proctoring features: Reinforcing examination integrity through cutting-edge AI . https://www.rosalyn.ai/blog/unveiling-rosalyn-ais-advanced-proctoring-features-reinforcing-examination-integrity-through-cutting-edge-ai

Sarkar, A. (2026). The hidden risks of autonomous IDEs: A study on Google Antigravity . Technical Disclosure Commons. https://www.tdcommons.org/cgi/viewcontent.cgi?article=11128&context=dpubs\_series

The Hacker News. (2025, September). Microsoft patches critical Entra ID vulnerability allowing MFA bypass. https://thehackernews.com/2025/09/microsoft-patches-critical-entra-id.html

University of the People. (2021). Administrative policies. UoPeople Graduate Catalog 2021-2022. https://catalog.uopeople.edu/wp-content/uploads/2021/09/New-Grad-Catalog-AY2021-22.pdf

University of the People. (n.d.). Technology. UoPeople Catalog. https://catalog.uopeople.edu/ug\_term1\_item/technology-library-and-other-university-services-and-offices/technology

University of the People. (2016, April). Proctored exams – Instructions to the student. https://www.uopeople.edu/wp-content/uploads/2016/04/Proctor\_instructions.pdf

University of the People. (n.d.). University of the People privacy policy. https://www.uopeople.edu/privacy-policy/

Zhang, L., & Miller, J. (2026). Debt behind the AI boom: Security vulnerabilities in autonomous coding agents . arXiv. https://arxiv.org/pdf/2603.28592

I got an email from my advisor stating the following changes (see above ). Question? Are we only required to use an AI proctor from now on forward? What about an in person proctor? Are they making an end to it?